@shawnstack/quickforge 1.7.2 → 1.7.4

package/server/channels/providers/wechat.mjs

@@ -4,6 +4,7 @@ import { promises as fs } from 'node:fs'
 import path from 'node:path'
 import { ProcessChannelProvider } from '../process-channel.mjs'
 import { getDefaultWorkspaceRoot, readProjectConfig } from '../../project-config.mjs'
+import { createNodeProcessEnv } from '../../utils/process-env.mjs'
 
 const WEIXIN_ACP_PACKAGE = 'weixin-acp'
 const MIN_NODE_MAJOR = 22
@@ -134,7 +135,7 @@ function runCommand(command, args, options = {}) {
 }
 
 export class WechatChannelProvider extends ProcessChannelProvider {
-  constructor({ projectRoot }) {
+  constructor({ projectRoot, channelEventsUrl, logsDir }) {
     super({
       id: 'wechat',
       name: '微信',
@@ -149,8 +150,9 @@ export class WechatChannelProvider extends ProcessChannelProvider {
         { id: 'relogin', label: '重新登录' },
       ],
       requirements: [`Node.js >= ${MIN_NODE_MAJOR}`, 'npm/npx 可用', '首次启动需要微信扫码登录'],
-    })
+    }, { logsDir })
     this.projectRoot = projectRoot
+    this.channelEventsUrl = channelEventsUrl
     this.launchWorkspace = null
   }
 
@@ -179,7 +181,11 @@ export class WechatChannelProvider extends ProcessChannelProvider {
       command: npxCommand(),
       args: ['-y', WEIXIN_ACP_PACKAGE, 'start', '--', acpCommand, ...acpArgs],
       cwd: this.launchWorkspace?.path || getDefaultWorkspaceRoot() || this.projectRoot,
-      env: process.env,
+      env: createNodeProcessEnv(process.env, {
+        QUICKFORGE_ACP_CHANNEL_ID: this.definition.id,
+        QUICKFORGE_ACP_CHANNEL_NAME: this.definition.name,
+        ...(this.channelEventsUrl ? { QUICKFORGE_CHANNEL_EVENTS_URL: this.channelEventsUrl } : {}),
+      }),
       shell: shouldUseShellForNpx(),
     }
   }

package/server/channels/registry.mjs

@@ -16,7 +16,11 @@ function attachProvider(provider) {
 export function initializeChannels(options = {}) {
   if (initialized) return
   initialized = true
-  attachProvider(createWechatChannelProvider({ projectRoot: options.projectRoot }))
+  attachProvider(createWechatChannelProvider({
+    projectRoot: options.projectRoot,
+    channelEventsUrl: options.channelEventsUrl,
+    logsDir: options.logsDir,
+  }))
 }
 
 function requireProvider(id) {

package/server/index.mjs

@@ -5,8 +5,9 @@ import path from 'node:path'
 import { randomUUID } from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { sendJson, sendError } from './utils/response.mjs'
-import { openBrowser } from './utils/platform.mjs'
+import { openBrowser, openPathInFileManager } from './utils/platform.mjs'
 import { ensureStorage, dataDir, configDir, storageDir, cacheDir, logsDir } from './storage.mjs'
+import { getNetworkProxyConfig, initializeNetworkProxy, refreshSystemProxy, updateNetworkProxyConfig } from './network-proxy.mjs'
 import { setDefaultWorkspaceRoot, initializeActiveProject, readProjectConfig, getActiveProject, readTerminalShellSetting, updateTerminalShellSetting, readTerminalShellConfig, updateTerminalShellConfig } from './project-config.mjs'
 import { getWorkspaceRoot } from './utils/workspace.mjs'
 import { handleStorageApi } from './routes/storage.mjs'
@@ -43,6 +44,7 @@ import { shutdown as shutdownAgentManager, resetStaleTaskStatuses } from './agen
 import { initializeChannels, shutdownChannels } from './channels/registry.mjs'
 import { shutdownMcpConnections } from './mcp/registry.mjs'
 import { shutdownTerminalSessions } from './terminal/terminal-manager.mjs'
+import { createNodeProcessEnv } from './utils/process-env.mjs'
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = path.dirname(__filename)
@@ -65,16 +67,16 @@ let restartInProgress = false
 let updateInProgress = false
 
 setDefaultWorkspaceRoot(process.env.QUICKFORGE_WORKSPACE_DIR || path.join(dataDir, 'workspace'))
-installAiHttpLogger()
 
 function getRestartSupport() {
   return { supported: true, reason: null }
 }
 
-async function getSystemStatus() {
+async function getSystemStatus({ isLocalRequest = true } = {}) {
   const config = await readProjectConfig()
   const restartSupport = getRestartSupport()
   const packageInfo = await getPackageInfo(projectRoot)
+  const restartSupported = isLocalRequest && restartSupport.supported
   return {
     ok: true,
     mode: isDev ? 'development' : 'production',
@@ -83,8 +85,14 @@ async function getSystemStatus() {
     startedAt,
     version: packageInfo.version,
     package: packageInfo,
-    restartSupported: restartSupport.supported,
-    restartUnsupportedReason: restartSupport.reason,
+    isLocalRequest,
+    capabilities: {
+      restart: restartSupported,
+      openLocalApps: isLocalRequest,
+      terminal: isLocalRequest,
+    },
+    restartSupported,
+    restartUnsupportedReason: isLocalRequest ? restartSupport.reason : 'Restart is only allowed from this computer',
     dataDir,
     configDir,
     storageDir,
@@ -113,10 +121,9 @@ function spawnRestartSupervisor() {
       stdio: 'ignore',
       windowsHide: true,
       shell: false,
-      env: {
-        ...process.env,
+      env: createNodeProcessEnv(process.env, {
         QUICKFORGE_NO_OPEN: '1',
-      },
+      }),
     })
 
     child.once('error', reject)
@@ -206,10 +213,9 @@ function spawnUpdateSupervisor(update) {
       stdio: 'ignore',
       windowsHide: true,
       shell: false,
-      env: {
-        ...process.env,
+      env: createNodeProcessEnv(process.env, {
         QUICKFORGE_NO_OPEN: '1',
-      },
+      }),
     })
 
     child.once('error', reject)
@@ -277,7 +283,7 @@ async function updateQuickForge() {
 }
 
 // --- Route dispatching ---
-async function handleApi(req, res, url) {
+async function handleApi(req, res, url, requestContext = {}) {
   const pathname = url.pathname
   const parts = pathname.split('/').filter(Boolean)
 
@@ -297,22 +303,22 @@ async function handleApi(req, res, url) {
     return
   }
 
-  if (pathname === '/api/lan-access/status' || pathname === '/api/lan-access/settings' || pathname === '/api/lan-access/unlock' || pathname === '/api/lan-access/logout' || pathname === '/api/lan-access/revoke-all') {
+  if (pathname.startsWith('/api/lan-access/')) {
     await handleLanAccessApi(req, res, url, {
       port,
-      isLocalRequest: isLoopbackAddress(req.socket.remoteAddress),
+      isLocalRequest: requestContext.isLocalRequest === true,
     })
     return
   }
 
   // Health check
   if (req.method === 'GET' && pathname === '/api/health') {
-    sendJson(res, 200, await getSystemStatus())
+    sendJson(res, 200, await getSystemStatus(requestContext))
     return
   }
 
   if (req.method === 'GET' && pathname === '/api/project/commands') {
-    await handleProjectApi(req, res, url)
+    await handleProjectApi(req, res, url, requestContext)
     return
   }
 
@@ -355,7 +361,9 @@ async function handleApi(req, res, url) {
   // Channels
   if (pathname === '/api/channels' || pathname.startsWith('/api/channels/')) {
     await handleChannelsApi(req, res, url, {
-      isLocalRequest: isLoopbackAddress(req.socket.remoteAddress),
+      isLocalRequest: requestContext.isLocalRequest === true,
+      logsDir,
+      openPathInFileManager,
     })
     return
   }
@@ -368,13 +376,13 @@ async function handleApi(req, res, url) {
 
   // Project routes
   if (pathname === '/api/project' || pathname.startsWith('/api/project/')) {
-    await handleProjectApi(req, res, url)
+    await handleProjectApi(req, res, url, requestContext)
     return
   }
 
   // Project workspace inspector routes
   if (pathname === '/api/workspace/tree' || pathname === '/api/workspace/file' || pathname === '/api/workspace/resolve-path' || pathname === '/api/workspace/open-external' || pathname.startsWith('/api/workspace/preview/')) {
-    await handleWorkspaceApi(req, res, url)
+    await handleWorkspaceApi(req, res, url, requestContext)
     return
   }
 
@@ -420,19 +428,22 @@ async function handleApi(req, res, url) {
   }
 
   // System routes
-  if (pathname === '/api/system/status' || pathname === '/api/system/restart' || pathname === '/api/system/network' || pathname === '/api/system/terminal-shell' || pathname === '/api/system/about' || pathname === '/api/system/update/check' || pathname === '/api/system/update/desktop' || pathname === '/api/system/update') {
+  if (pathname === '/api/system/status' || pathname === '/api/system/restart' || pathname === '/api/system/network' || pathname === '/api/system/network-proxy' || pathname === '/api/system/network-proxy/refresh' || pathname === '/api/system/terminal-shell' || pathname === '/api/system/about' || pathname === '/api/system/update/check' || pathname === '/api/system/update/desktop' || pathname === '/api/system/update') {
     await handleSystemApi(req, res, url, {
-      getSystemStatus,
+      getSystemStatus: () => getSystemStatus(requestContext),
       requestRestart,
       getPackageInfo: () => getPackageInfo(projectRoot),
       checkForUpdates: () => checkForUpdates(projectRoot),
       checkDesktopRelease: () => checkDesktopRelease(projectRoot),
       updateQuickForge,
-      isLocalRequest: isLoopbackAddress(req.socket.remoteAddress),
+      isLocalRequest: requestContext.isLocalRequest === true,
       getTerminalShellSetting: readTerminalShellSetting,
       updateTerminalShellSetting,
       getTerminalShellConfig: readTerminalShellConfig,
       updateTerminalShellConfig,
+      getNetworkProxyConfig,
+      updateNetworkProxyConfig,
+      refreshSystemProxy,
       host,
       port,
       remoteEnabled: host !== '127.0.0.1' && host !== 'localhost',
@@ -443,7 +454,7 @@ async function handleApi(req, res, url) {
   // Terminal routes (local-only; real shell access)
   if (pathname === '/api/terminal/capabilities' || pathname === '/api/terminal/sessions' || pathname.startsWith('/api/terminal/sessions/')) {
     await handleTerminalApi(req, res, url, {
-      isLocalRequest: isLoopbackAddress(req.socket.remoteAddress),
+      isLocalRequest: requestContext.isLocalRequest === true,
     })
     return
   }
@@ -529,6 +540,7 @@ function isLanAccessBootstrapPath(pathname) {
 
 function isStaticAssetPath(pathname) {
   return pathname.startsWith('/assets/')
+    || pathname.startsWith('/downloads/')
     || pathname === '/favicon.svg'
     || pathname === '/vite.svg'
     || pathname === '/manifest.webmanifest'
@@ -607,7 +619,7 @@ const server = createServer(async (req, res) => {
     }
 
     if (url.pathname.startsWith('/api/')) {
-      await handleApi(req, res, url)
+      await handleApi(req, res, url, { isLocalRequest: !isRemoteRequest })
       return
     }
 
@@ -669,7 +681,13 @@ server.on('upgrade', (req, socket, head) => {
 })
 
 await ensureStorage()
-initializeChannels({ projectRoot })
+await initializeNetworkProxy()
+installAiHttpLogger()
+initializeChannels({
+  projectRoot,
+  channelEventsUrl: `http://127.0.0.1:${port}/api/channels/events`,
+  logsDir,
+})
 await resetStaleTaskStatuses()
 await initializeActiveProject()
 setActiveWorkspaceRootForFilesystem(getWorkspaceRoot())

package/server/lan-access-store.mjs

@@ -80,13 +80,41 @@ async function writeLanAccessFile(config) {
   await fs.writeFile(LAN_ACCESS_FILE, `${JSON.stringify(normalizeConfig(config), null, 2)}\n`, 'utf8')
 }
 
+function normalizeText(value, maxLength) {
+  if (typeof value !== 'string') return undefined
+  const text = value.trim()
+  return text ? text.slice(0, maxLength) : undefined
+}
+
+function normalizeRemoteAddress(value) {
+  const address = normalizeText(value, 128)
+  return address?.startsWith('::ffff:') ? address.slice(7) : address
+}
+
+function tokenRecordId(tokenRecord) {
+  const id = normalizeText(tokenRecord?.id, 128)
+  return id || `legacy_${sha256Base64Url(tokenRecord?.tokenHash || '').slice(0, 24)}`
+}
+
+function publicTokenRecord(tokenRecord) {
+  return {
+    id: tokenRecordId(tokenRecord),
+    address: normalizeRemoteAddress(tokenRecord.remoteAddress),
+    userAgent: normalizeText(tokenRecord.userAgent, 300),
+    issuedAt: tokenRecord.issuedAt,
+    expiresAt: tokenRecord.expiresAt,
+  }
+}
+
 function publicStatus(config) {
+  const activeTokens = pruneTokens(config.tokens)
   return {
     enabled: Boolean(config.enabled),
     hasPassword: Boolean(config.passwordHash),
     sessionTtlHours: config.sessionTtlHours,
     authVersion: config.authVersion || 1,
-    activeTokenCount: pruneTokens(config.tokens).length,
+    activeTokenCount: activeTokens.length,
+    activeDevices: activeTokens.map(publicTokenRecord),
     updatedAt: config.updatedAt,
   }
 }
@@ -98,6 +126,12 @@ function pruneTokens(tokens, now = Date.now()) {
       if (!tokenRecord.expiresAt) return true
       return Date.parse(tokenRecord.expiresAt) > now
     })
+    .map((tokenRecord) => ({
+      ...tokenRecord,
+      id: tokenRecordId(tokenRecord),
+      remoteAddress: normalizeRemoteAddress(tokenRecord.remoteAddress),
+      userAgent: normalizeText(tokenRecord.userAgent, 300),
+    }))
     .slice(-LAN_TOKEN_MAX_COUNT)
 }
 
@@ -162,11 +196,58 @@ export async function revokeLanAccessTokens() {
   })
 }
 
+export async function revokeLanAccessTokenById(id) {
+  const normalizedId = normalizeText(id, 128)
+  if (!normalizedId) {
+    const error = new Error('LAN access session id is required.')
+    error.statusCode = 400
+    throw error
+  }
+  return enqueueWrite(writeQueueName, async () => {
+    const current = await readLanAccessFile()
+    const tokens = pruneTokens(current.tokens)
+    const nextTokens = tokens.filter((tokenRecord) => tokenRecordId(tokenRecord) !== normalizedId)
+    if (nextTokens.length === tokens.length) {
+      const error = new Error('LAN access session not found.')
+      error.statusCode = 404
+      throw error
+    }
+    const next = normalizeConfig({
+      ...current,
+      tokens: nextTokens,
+      updatedAt: new Date().toISOString(),
+    })
+    await writeLanAccessFile(next)
+    return publicStatus(next)
+  })
+}
+
+export async function revokeLanAccessToken(token) {
+  if (!token || typeof token !== 'string') return false
+  const [versionText, secret] = token.split('.')
+  if (!secret) return false
+  const actualHash = sha256Base64Url(secret)
+  return enqueueWrite(writeQueueName, async () => {
+    const current = await readLanAccessFile()
+    if (Number(versionText) !== (current.authVersion || 1)) return false
+    const tokens = pruneTokens(current.tokens)
+    const nextTokens = tokens.filter((tokenRecord) => !safeHashEqual(tokenRecord.tokenHash, actualHash))
+    if (nextTokens.length === tokens.length) return false
+    const next = normalizeConfig({
+      ...current,
+      tokens: nextTokens,
+      updatedAt: new Date().toISOString(),
+    })
+    await writeLanAccessFile(next)
+    return true
+  })
+}
+
 export function lanAccessCookieName() {
   return 'qf_lan_access'
 }
 
-export async function issueLanAccessToken(password) {
+export async function issueLanAccessToken(password, metadata = {}) {
   return enqueueWrite(writeQueueName, async () => {
     const current = await readLanAccessFile()
     if (!current.enabled || !current.passwordHash) {
@@ -185,11 +266,20 @@ export async function issueLanAccessToken(password) {
     const issuedAt = new Date().toISOString()
     const ttlMs = normalizeSessionTtlHours(current.sessionTtlHours) * 60 * 60 * 1000
     const expiresAt = new Date(Date.now() + ttlMs).toISOString()
+    const tokenRecord = {
+      id: createRandomToken(18),
+      tokenHash,
+      issuedAt,
+      expiresAt,
+      authVersion: current.authVersion || 1,
+      remoteAddress: normalizeRemoteAddress(metadata.remoteAddress),
+      userAgent: normalizeText(metadata.userAgent, 300),
+    }
     const next = normalizeConfig({
       ...current,
       tokens: [
         ...pruneTokens(current.tokens),
-        { tokenHash, issuedAt, expiresAt, authVersion: current.authVersion || 1 },
+        tokenRecord,
       ].slice(-LAN_TOKEN_MAX_COUNT),
       updatedAt: issuedAt,
     })